Extracted

• • Target

    b676dadc109d8b1322111502103a943073180b3daa78a04637448b148730736d.exe

  • Size

    46KB

  • MD5

    8462795ada587c3bccdb59c2f48e5bfe

  • SHA1

    ae155c1d78ba4adfbfe5aa022a2deb725fc1dc9a

  • SHA256

    b676dadc109d8b1322111502103a943073180b3daa78a04637448b148730736d

  • SHA512

    7860b4447fe17084e0225a052d9712b3fe332cdd6e4f59d1057e4613c07c416f1cfe36c1a49bf0f631a4289ac49fb24518c63fb03ed7a6df2af832361e764ff6

  • SSDEEP

    768:qdhO/poiiUcjlJInfFH9Xqk5nWEZ5SbTDa/WI7CPW5w:Mw+jjgnNH9XqcnW85SbT+WII

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2